The report also explained the contrasts between simple, moderate and sophisticated attacks, and provides defenders with advice on how to detect and prevent each type of attack.

Key findings Include:

• In the days following a public breach websites experience three times more credential stuffing attacks than the average of two-three attacks per month.
• Fifty percent of ATO attacks come in the form of volumetric credential stuffing, where bad bot requests are easily identifiable and attempted in bursts, typically looking like a spike of requests above the baseline. The other half of ATO attacks are through low and slow credential stuffing and credential cracking, identified by consistent, continuous login requests that bad bots run 24/7, often flying under the radar due to its slow pace.
• Smaller scale “test round” incursions preceded almost 20% of all analyzed attacks.
• Thirty-nine percent of volumetric ATO attacks occur on a Friday or Saturday. Bot operators schedule attacks when it presumed that fewer security professionals will be around to notice anomalies.

Every time a breach comes to light and exposing consumer credentials, any business with a login page should prepare themselves for a swell of volumetric credential stuffing attacks, Anna Westelius, senior director of security research at Distil Networks said. “While bot operators may be purposeful in their strategy of carrying out ATO attacks, this data also renders them predictable. Organizations must educate themselves to identify the warnings signs and be prepared for times when an attacker may strike.”

Westelius explained a login attack involves a bot or script trying to automatically access a login endpoint. “Either to test sets of credentials or if they have a valid login they can use them somewhere else or to get access to information, PII, credit card data, to sell or distribute.”

Financial institution and fintech type attacks are more direct because of the monetary incentive or very, high value data. When it comes to non-financial data hackers just want to verify the validity of credentials for later use. “(Attackers) get access to so much more when it comes to financial institutions in comparison to other types of websites,” Westelius suggested. “So that's really where we see the highest level of sophistication of attackers.”

“I would say that one of the surprising things is you would not expect absolutely every website to have these types of issues,” Westelius noted. She added Distil researcher were also a bit surprised as to the frequency of these attacks and the weekend liability “We had heard a lot of our customers are complaining about their security not being allowed to go home on Friday and having to work weekends to battle these problems. Attackers really think about when someone's going to be there and try to adapt to when no one's going to notice alarms going off.”